> ## Documentation Index
> Fetch the complete documentation index at: https://docs.certgov.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Issuance Profiles

> Issuance Profiles define the certificate authority, key algorithm, validity period, and renewal settings used when a Trust Profile issues a certificate.

An **Issuance Profile** is a reusable CA + certificate shape configuration. Trust Profiles reference an Issuance Profile as their default; it determines which CA signs the cert and what the cert looks like.

***

## What an Issuance Profile defines

| Setting                   | Description                                                                                                 |
| ------------------------- | ----------------------------------------------------------------------------------------------------------- |
| **Certificate Authority** | The CA that signs the certificate — Let's Encrypt (ACME), DigiCert, internal CA, Azure Key Vault.           |
| **Key algorithm**         | `ecdsa-p256` (recommended), `ecdsa-p384`, or `rsa-2048`.                                                    |
| **Validity days**         | Certificate lifetime (e.g., 90 days for Let's Encrypt, up to 825 for DigiCert).                             |
| **Renewal threshold**     | Number of days before expiry to trigger renewal. Default: 30 days.                                          |
| **Allow wildcards**       | Whether this profile can issue `*.example.com` certs.                                                       |
| **DNS account**           | ACME DNS-01 challenge account used for wildcard validation. Required if wildcards are enabled for ACME CAs. |

***

## Create an Issuance Profile

### Via the UI

1. Navigate to **Trust Profiles** in the sidebar.
2. Click **Issuance Profiles** (top tab or sub-navigation).
3. Click **New Issuance Profile**.
4. Select a **Certificate Authority** from the list. If no CA is configured, set one up first:
   * Let's Encrypt (public ACME): [ACME Setup guide](/guides/acme-setup)
   * DigiCert or other commercial CA: [CA Connectors guide](/guides/ca-connectors)
   * Internal / private CA: [Internal CA guide](/guides/internal-ca)
   * Azure Key Vault: [AKV guide](/guides/azure-key-vault)
5. Choose **Key Algorithm** — `ecdsa-p256` is recommended for new deployments.
6. Set **Validity Days** and **Renewal Threshold**.
7. Enable **Allow Wildcards** if this profile will cover `*.domain` patterns.
8. If using ACME with wildcards, select or configure a **DNS Account** for DNS-01 challenge.
9. Save.

***

## Recommended settings for public domains

For public domains using Let's Encrypt:

| Setting           | Value                             |
| ----------------- | --------------------------------- |
| CA                | Let's Encrypt (ACME)              |
| Key algorithm     | `ecdsa-p256`                      |
| Validity days     | `90`                              |
| Renewal threshold | `30`                              |
| Allow wildcards   | Enabled (requires DNS-01 account) |

***

## ACME and wildcard certificates

Let's Encrypt wildcard certificates (`*.example.com`) require DNS-01 challenge validation — Let's Encrypt must verify you control the domain by checking a TXT record at `_acme-challenge.example.com`. HTTP-01 challenge cannot issue wildcards.

To issue wildcards via ACME:

1. Configure a DNS account (Route 53, Cloudflare, Azure DNS, etc.) in **Settings → DNS Accounts**.
2. On the Issuance Profile, enable **Allow Wildcards** and select that DNS account.

See [DNS Validation](/guides/dns-validation) for provider-specific setup.

***

## Assigning to a Trust Profile

An Issuance Profile takes effect when it is set as the **Default Issuance Profile** on a Trust Profile. Multiple Trust Profiles can reference the same Issuance Profile — for example, a single `letsencrypt-90d` profile shared across all internal domains.

***

## Checking configuration

```
"List my issuance profiles"
→ list_issuance_profiles()

"Does the trust profile for fun.example.com have a CA configured?"
→ check_domain(domain="fun.example.com")
```